Fixes:

It's bug in nodeAgg.c on lines 241, 242:

                null_array = malloc(nagg);
                for (i=0;i<nagg;i++)
                    null_array[i] = 'n';
                oneTuple = heap_formtuple(tupType, tupValue, null_array);

- your query has not only aggregates but also 'group by-ed' fields and so
null_array should contain tupType->natts elements (tupType->natts > nagg in
your case).

Patch follows and it's very simple.

VAdim

src/backend/executor/nodeAgg.c

@@ -238,8 +238,8 @@ ExecAgg(Agg *node)
 		tupValue = 	projInfo->pi_tupValue;
 		
 		/* initially, set all the values to NULL */
-		null_array = malloc(nagg);
-		for (i=0;i<nagg;i++)
+		null_array = malloc(tupType->natts);
+		for (i=0;i<tupType->natts;i++)
 		    null_array[i] = 'n';
 		oneTuple = heap_formtuple(tupType, tupValue, null_array);
 		free(null_array);